웹마스터 팁
Bind 설정하기
2014.07.30 16:23
요새는 직접 서버를 다루는 일이 거의 없는거 같더군요..
앞으로 조금씩 이전에 제가 서버 관리하면서 기록한 것들을 적어보려고 합니다.
이전에 기록한 것들이지만, 직접 설치해 보거나 설정하는데.. 도움이 될거라 생각이 되는데.. ^^;
#############################################
# Bind 설정하기
#############################################
# ps ax|grep bind
22217 pts/0 S+ 0:00 grep bind
# rpm -qa|grep bind
bind-utils-9.3.3-10.el5
bind-9.3.3-10.el5
bind-chroot-9.3.3-10.el5
bind-libs-9.3.3-10.el5
ypbind-1.19-8.el5
yum을 사용하면 yum install bind bind-utils 이처럼 사용하면 쉽게 설치가 가능한다..
# /etc/init.d/named start
Locating /var/named/chroot//etc/named.conf failed: [FAILED]
: 설치후 바로 실행 본다. 역시 named.conf가 없다면 에러 발생.
그럼 named.conf 샘플 파일을 찾아보자.(conf 파일은 거의 모든 패키지에서 샘플 파일 제공함)
# find / -name named.conf
/etc/dbus-1/system.d/named.conf
/usr/share/doc/bind-9.3.3/sample/etc/named.conf
/usr/share/logwatch/default.conf/services/named.conf
예제 파일들은 해당 디렉토리로 이동하자.
일반적으로 named.conf는 /etc 밑에 두는데, bind-chroot 패키지를 설치했다면.. /var/named/chroot/etc/밑에 두어야 한다.
해당 파일들을 복사하자.
# cp /usr/share/doc/bind-9.3.4/sample/etc/named.conf /var/named/chroot/etc/
# cp /usr/share/doc/bind-9.3.4/sample/etc/named.root.hints /var/named/chroot/etc/
# cp /usr/share/doc/bind-9.3.4/sample/etc/named.rfc1912.zones /var/named/chroot/etc/
# cp /usr/share/doc/bind-9.3.4/sample/etc/rndc.conf /var/named/chroot/etc/
# cd /var/named/chroot/etc/
# l
total 48
-rw-r--r-- 1 root root 380 Mar 19 06:12 localtime
-rw-r--r-- 1 root root 4384 Mar 19 15:55 named.conf
-rw-r--r-- 1 root root 1046 Mar 19 14:51 named.rfc1912.zones
-rw-r--r-- 1 root root 524 Mar 19 14:07 named.root.hints
-rw-r--r-- 1 root root 0 Mar 19 14:10 rndc.conf
그리고 기본 zone 파일과 root 파일들을 복사해 오자.
# ll /usr/share/doc/bind-9.3.3/sample/var/named/
total 104
drwxr-xr-x 4 root root 4096 Mar 19 02:54 .
drwxr-xr-x 3 root root 4096 Mar 19 02:54 ..
drwxr-xr-x 2 root root 4096 Nov 11 00:22 data
-rw-r--r-- 1 root root 198 Mar 7 2006 localdomain.zone
-rw-r--r-- 1 root root 195 Mar 7 2006 localhost.zone
-rw-r--r-- 1 root root 56 Nov 11 00:22 my.external.zone.db
-rw-r--r-- 1 root root 56 Nov 11 00:22 my.internal.zone.db
-rw-r--r-- 1 root root 427 Mar 7 2006 named.broadcast
-rw-r--r-- 1 root root 424 Mar 7 2006 named.ip6.local
-rw-r--r-- 1 root root 426 Mar 7 2006 named.local
-rw-r--r-- 1 root root 2518 Mar 7 2006 named.root
-rw-r--r-- 1 root root 427 Mar 7 2006 named.zero
drwxr-xr-x 2 root root 4096 Mar 19 02:54 slaves
# cp -R /usr/share/doc/bind-9.3.4/sample/var/named/* /var/named/chroot/var/named/
그리고 named의 소유권을 named에게 주자.
# chown -R named:named /var/named/chroot/var/named
# l
total 104
-rw-r--r-- 1 named named 210 Mar 19 15:48 9.rev
-rw-r--r-- 1 named named 251 Mar 19 13:59 cent.aaa.net.zone
drwxrwx--- 2 named named 4096 Mar 19 16:11 data
-rw-r--r-- 1 named named 198 Mar 19 14:23 localdomain.zone
-rw-r--r-- 1 named named 195 Mar 19 14:23 localhost.zone
-rw-r--r-- 1 named named 56 Mar 19 14:23 my.external.zone.db
-rw-r--r-- 1 named named 56 Mar 19 14:23 my.internal.zone.db
-rw-r--r-- 1 named named 427 Mar 19 14:23 named.broadcast
-rw-r--r-- 1 named named 424 Mar 19 14:23 named.ip6.local
-rw-r--r-- 1 named named 426 Mar 19 14:23 named.local
-rw-r--r-- 1 named named 2518 Mar 19 14:23 named.root
-rw-r--r-- 1 named named 427 Mar 19 14:23 named.zero
drwxrwx--- 2 named named 4096 Mar 19 14:37 slaves
한번에 하려면..(버전 확인을 꼭 하자)
# cp /usr/share/doc/bind-9.3.4/sample/etc/named.conf /var/named/chroot/etc/; cp /usr/share/doc/bind-9.3.4/sample/etc/named.root.hints /var/named/chroot/etc/; cp /usr/share/doc/bind-9.3.4/sample/etc/named.rfc1912.zones /var/named/chroot/etc/; cp /usr/share/doc/bind-9.3.4/sample/etc/rndc.conf /var/named/chroot/etc/; cp -R /usr/share/doc/bind-9.3.4/sample/var/named/* /var/named/chroot/var/named/; chown -R named:named /var/named/chroot/var/named;
그럼 이제 dns keygen을 생성하자.
# dns-keygen
DnneBbL71L4nOLrYtCOD1hmzKNrVdYLXNq2gVqlD9sgO87wHjnqYrNoAkG75
# vi named.conf
......................
key ddns_key
{
algorithm hmac-md5;
#secret "use /usr/sbin/dns-keygen to generate TSIG keys"; // 기존 라인 주석처리
secret "DnneBbL71L4nOLrYtCOD1hmzKNrVdYLXNq2gVqlD9sgO87wHjnqYrNoAkG75"; // 새로이 라인 생성
};
대충 설정이 끝냈다..
named를 실행해 보자..
# /etc/init.d/named start
Starting named: [ OK ]
이처럼 뜨지 않는다면..
# tail -f /var/log/messages
로 기록된 데이타를 기록해 보자.
이곳에 에러의 원인이 기록되어 있을 것이다.
그럼 이제 실제 도메인을 세팅해 보자.
# cd /var/named/chroot/etc
# vi named.conf 파일을 수정하자
view "localhost_resolver"
{
/* This view sets up named to be a localhost resolver ( caching only nameserver ).
* If all you want is a caching-only nameserver, then you need only define this view:
*/
match-clients { localhost; };
match-destinations { localhost; };
recursion yes;
# all views must contain the root hints zone:
include "/etc/named.root.hints";
/* these are zones that contain definitions for all the localhost
* names and addresses, as recommended in RFC1912 - these names should
* ONLY be served to localhost clients:
*/
include "/etc/named.rfc1912.zones";
include "/etc/named.rev.conf"; // reverse file <== 추가
include "/etc/named.zone.conf"; // zone file <== 추가
};
......................
view "external"
{
/* This view will contain zones you want to serve only to "external" clients
* that have addresses that are not on your directly attached LAN interface subnets:
*/
match-clients { any; };
match-destinations { any; };
recursion no;
// you'd probably want to deny recursion to external clients, so you don't
// end up providing free DNS service to all takers
// all views must contain the root hints zone:
include "/etc/named.root.hints";
// These are your "authoritative" external zones, and would probably
// contain entries for just your web and mail servers:
zone "my.external.zone" {
type master;
file "my.external.zone.db";
};
include "/etc/named.zone.conf"; // zone file <== 추가
};
......................
이처럼 사용해 주고,
named.rev.conf 에는 reverse 를 지정해 주고..
named.zone.conf 에는 named를 지정해 주자.
// 아이피가 12.34.56.78이면.. 맨 마지막 클래스를 제외하고, 역숙으로 arpa를 지정해야 한다.
// 56.34.12.in-addr.arpa가 되게 된다.
// 해당 리버스 파일명은 임의대로 주어도 되나, 편의상 마지막 클래스를 사용했다. 78.rev
// reverse file //////////////////////////////
zone "56.34.12.in-addr.arpa" in{
type master;
file "78.rev";
allow-update{none;};
};
// 존파일 설정.
// 존 파일명도 임의로 지정해도 되나, 일반적으로 도메인명.zone으로 많이 사용한다.
// zone of xxx.com ///////////////////////
zone "xxx.com" in{
type master;
file "xxx.com.zone";
allow-update{none;};
};
해당 파일들을 생성하자.
# cd /var/named/chroot/var/named/
# vi 78.rev
$TTL 86400
@ IN SOA ns.xxx.com. system.xxx.com. (
0803191120
10800
3600
3600000
43200 )
; Name Server
IN NS xxx.com.
IN MX 10 mail
78 IN PTR xxx.com.
78 IN PTR mail.xxx.com.
; 주의할 것은 78은 임의로 지정하는 것이 아니고, 아이피의 맨 마지막 클래스이다..
# vi xxx.com.zone
$TTL 86400
@ IN SOA ns.xxx.com. system.xxx.com. (
0803181357
10800
3600
3600000
43200 )
; Name Server
IN NS xxx.com.
IN A 12.34.56.78
IN MX 10 mail
; Host Name
ns IN A 12.34.56.78
www IN CNAME ns
mail IN A 12.34.56.78
이제 재실행해 보자..
# /etc/init.d/named start
Starting named: [ OK ]
# tail -f /var/log/messages
Mar 19 15:55:19 cent named[23302]: zone 255.in-addr.arpa/IN/localhost_resolver: loaded serial 42
Mar 19 15:55:19 cent named[23302]: zone 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN/localhost_resolver: loaded serial 1997022700
Mar 19 15:55:19 cent named[23302]: zone localdomain/IN/localhost_resolver: loaded serial 42
Mar 19 15:55:19 cent named[23302]: zone localhost/IN/localhost_resolver: loaded serial 42
Mar 19 15:55:19 cent named[23302]: zone cent.aaa.net/IN/localhost_resolver: loaded serial 803181158
Mar 19 15:55:19 cent named[23302]: running
Mar 19 15:55:19 cent named[23302]: zone 234.118.210.in-addr.arpa/IN/localhost_resolver: sending notifies (serial 803191120)
Mar 19 15:55:19 cent named[23302]: zone xxx.com/IN/localhost_resolver: sending notifies (serial 803181158)
Mar 19 15:55:19 cent named[23302]: client 12.34.56.78#32775: view localhost_resolver: received notify for zone '56.34.12.in-addr.arpa'
Mar 19 15:55:19 cent named[23302]: client 12.34.56.78#32775: view localhost_resolver: received notify for zone 'xxx.com'
로그기록도 정상적이다..
이제 nslookup으로 확인해 보자.
# nslookup
> server 127.0.0.1
Default server: 127.0.0.1
Address: 127.0.0.1#53
> xxx.com
Server: 127.0.0.1
Address: 127.0.0.1#53
Name: xxx.com
Address: 12.34.56.78
외부 dns를 이용해 테스트 해 보자.
> server 210.220.163.82
Default server: 210.220.163.82
Address: 210.220.163.82#53
> xxx.com
Server: 210.220.163.82
Address: 210.220.163.82#53
Non-authoritative answer:
Name: xxx.com
Address: 12.34.56.78